EKS support for signing containers with SHA (via ECR)

**Tell us about your request**
EKS support for Image signing with SHA hash (via ECR) like is supported here
https://aws.amazon.com/about-aws/whats-new/2019/10/amazon-ecs-now-supports-ecs-image-sha-tracking/

**Which service(s) is this request for?**
this is for EKS this capability exists already in ECR (for ECS)

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
trying to make sure only signed images are run on the EKS cluster.
signed from the specific CICD build/deploy process

**Are you currently working around this issue?**
I do not yet have a workaround, was hoping for a generic pattern.

**Additional context**
this could possibly be done via open policy agent.
https://github.com/open-policy-agent/opa

Start by reviewing the linked ECS image SHA-tracking announcement and how the existing ECR capability relates to EKS. Investigate the suggested Open Policy Agent approach and define what would ensure that only images signed by the specified CI/CD process run in the EKS cluster; the issue is done when that capability or pattern is documented and supported.

Written by the indexing model from the issue text.